The vulnerability resides in the ALSA sequencer subsystem of the Linux kernel. When snd_seq_read() copies a queued variable‑length event header to user space, it clears the length bits but leaves the event pointer field intact. This allows a user‑space sequencer client to read back a raw kernel address from the event header, exposing internals of the kernel memory layout. The weakness corresponds to a pointer manipulation flaw (CWE‑824).

The issue affects Linux kernel systems that compile the ALSA sequencer driver and have not applied the patch that zeroes the event pointer before copying data to user space. Version details are not specified in the advisory.

A local user can craft a sequencer event and retrieve a kernel address by invoking snd_seq_read(). No privilege escalation or network access is required. While the flaw does not directly lead to code execution or denial of service, the disclosed address can aid in subsequent exploits such as return‑oriented programming. The CVSS score of 5.5 indicates moderate severity, the EPSS is less than 1 %, and the vulnerability is not listed in CISA KEV, suggesting a low likelihood of widespread exploitation. Overall, the risk is moderate in potential impact but low in probability for typical environments.